I've noticed that a lot of diet-related spam is coming from few recently created domains, all registered to a George Zimmerman from Canada. I've trapped spam from:
atsdiet.biz avudiet.biz beidiet.biz I think it's pretty safe to assume that our George has Registered many more ???diet.biz or just *diet.biz domains. Therefore, I've added the following rule in my site: uri IA_EvilDietBIZ /diet\.biz\b/i score IA_EvilDietBIZ 3.0 describe IA_EvilDietBIZ URI ending in diet.biz
